octet 0.10.1

A Pi-compatibility and release tooling fix release. Publication and asset availability must be confirmed on the version-pinned release page; the source version alone does not establish publication. npm publication is separate.

Release tooling#

• Add a default-off force_release manual input to waive source CI qualification explicitly, with an actor/source audit summary. Immutable source checks, dependency audits, release build checks and protected signing remain required; workflow-only repairs can be dispatched from their dedicated tooling tag.

Security#

• Update pulldown-cmark from 0.13.5 to 0.13.6 for RUSTSEC-2026-0433 (quadratic parsing of nested image wikilinks). octet does not enable the affected wikilinks extension.

Fixed#

• A Pi theme you selected, and Pi's built-in palettes, load as they do in Pi instead of ending a reload with rejected resource path: untrusted workspace resource has no explicit path grant and default theme was not an admitted theme file. A palette under your Pi agent directory (or OCTET_PI_AGENT_DIR, ~/.octet, ~/.agents) is a user resource, so it is never classified as a project resource even when the workspace contains it (for example when you start octet from your home directory), and it therefore needs no workspace trust grant. Project palettes still require trust, and a refused theme now names the file and the reason.

• Pi prompt hooks no longer run under an Octet-only deadline. input, before_agent_start and context collection await handlers the way Pi does, so a handler that waits for a user answer still delivers its prompt transform or system-prompt replacement instead of having it silently dropped.

• The Pi bridge can create native child agent sessions, so createAgentSession callers work under the same owner, generation, cancellation and accounting fences as the delegation extension. No other extension name receives it.

• Print and plain modes run Pi input hooks before template/skill expansion and prompt composition. Transforms retain images; handled input starts no provider request and saves no user prompt, matching Pi's print path.

• A failing Pi context hook no longer ends the run with provider context preparation refused: hook refused preparation. Handler failures, malformed projections and remote refusals are isolated the way Pi isolates them: the extension's changes are skipped, one warning is reported per session, and the request proceeds unmodified. Any remaining refusal now names the request shape, for example 40 messages, 40 tools, 118.0 KiB tool schema (largest: mcp_ableton_get_session_info 9.1 KiB), request 214.0 KiB, instead of an unactionable reason.

• /extensions can switch any extension off again. A mirrored Pi codemode preference used to mark activation as overridden and make every row read-only; it is now an ordinary enable, and a Disable is recorded in disabled_extensions, which outranks project, environment, CLI and mirrored activation on the next launch. A project layer cannot silence an extension.

• --no-extensions (-ne) also covers the mirrored Pi codemode preference. The clear ran before Pi settings were applied, so codemode stayed active; native activation is now applied last.

• --model <provider>/<model> resolves when that provider exposes the model, so the two-column model list can be pasted as one value. An unavailable model no longer claims a resume is in flight when none is.

• Pi UI dialogs in print and plain modes answer the way Pi's noOpUIContext does (custom/select/input → undefined, confirm → false) instead of mounting a surface nobody can see and holding the hook open until the transport timed out.

• Documented the headless @gotgenes/pi-permission-system tool-hook stall, its 30 s timeout, and the misleading zero exit status in Pi compatibility deviations.

• Startup failures retain owner/instance/generation attribution and safe remote error codes when resource discovery is blocked after process reload. Private remote messages remain redacted; discovery still requires successful startup.

• Informational theme-discovery skips no longer become red reload failures. Ungranted extension resource paths are still rejected and reported.

• Large Pi/MCP tool fleets are no longer refused by a default 128 KiB tool-schema quota. Complete definitions remain unchanged and subject to full-request model context admission; Rust hosts can still set an explicit byte quota, inherited by delegated agents.

• Pi session-name writes acknowledge the committed, normalized name, including clears, even without a custom footer, editor or widget. Concurrent host snapshots cannot leave the adapter reading the old name until another shell update, and late acknowledgements cannot cross a retired session owner.

• Subagent chrome continues updating while the parent waits for input after its turn ends. Worker telemetry is session-lived; background roster refresh failures retain the last accepted view and go to extension diagnostics instead of adding repeated transcript notices.

• Compaction accepts textual summaries up to 2 MiB (previously 128 KiB), including the host-derived file list, so routes that cannot enforce the requested output budget no longer fail compaction of long sessions; this was reported with long Codex sessions. Oversized output is still refused before any checkpoint is published, and opaque native Responses compaction state is unchanged. Branch summaries and extension-supplied replacement summaries share the same bound.

• Subagent lifecycle and tool-status events keep neutral transcript separators, independent of theme density and painted surface padding.

• Top-clipped tool images retain their original horizontal gutter while scrolling. Repeated viewport crops compose correctly, and image placement preserves the text cursor and payload-free diagnostic logs.

• Reasoning prose preserves the terminal foreground when its background is unknown, rather than guessing a gray that loses contrast on common palettes. Known light/dark profiles and explicit theme colors remain unchanged.

• Release documentation inventory includes the retained Pi design, historical benchmark evidence, theme profile, linked adapter guides and TypeBox license, while excluding per-run maintainer notes and unreviewed patch backups from installed documentation. Git records remain unchanged.

• Pi custom-provider streams and inherited native delegation use bundled pure context helpers and request-option parsing, without accidentally requiring an installed Pi runtime. Explicit installed-Pi helpers retain their version gates.

• Pi custom-provider compatibility defaults and OpenRouter session-affinity headers match parsed endpoint hostnames, not provider names embedded in URL paths or lookalike hosts. Explicit provider IDs and compatibility overrides still take precedence; credential and endpoint authority are unchanged.

• Native Pi notification tests follow the concise grouped notice format while continuing to reject private exception text and factory paths.

• Unix bash background descendants with redirected output remain supervised when no execution deadline is configured, instead of being killed at shell exit by an overflowing deadline calculation. Cancellation and host cleanup still apply.

• Incremental assistant rendering rebuilds the block when neighboring surface geometry changes, rather than reusing rows with stale spacing.

• Provider-credential responses are fenced against host-owner retirement during asynchronous resolution and writer admission. This grants no new credential capability and does not enable generic Pi inference.

• The Pi adapter no longer shows parent settled or active numeric parent_request_id required notices. They mean an extension's late work lost its finished request, which the user cannot act on; the cause stays in the log.

• Pi extension tools that write session entries (pi-web-access web_search, rpiv-todo todo) no longer fail with missing field session_leaf. The host forwards the operation's own single-use session grant on tool/call and the adapter presents it; the numeric-parent, owner, generation, single-use and bound checks on every append are unchanged, and a request without a causal driver (parallel waves) still carries no grant.

• Pi mcp search (pi-mcp-adapter) no longer fails with unsupported_feature ctx.modelRegistry.classify. The adapter feature-detects Pi's classifier API on every search; ctx.modelRegistry.classify and findOfType now read as absent (octet has no classifier-model contract), so word search works and semantic search reports itself unavailable. No credential path changes.

• A prompt entered while octet is busy (compaction, hooks, a thinking change) is queued once and sent when the wait ends, so Enter no longer has to be repeated. Commands and shell escapes are still never queued as model input. Busy and thinking notices are one short line each.

• Extension tool calls may wait up to 10 minutes for a person to answer a dialog (it was 30 seconds, which cut ask_user dialogs short); Esc still cancels.

• Pi /mcp (pi-mcp-adapter) no longer takes the extension host down. The keybinding facades handed to custom UI factories and returned by getKeybindings() threw unsupported_feature keybindings.getUserBindings on the adapter's optional getUserBindings?.() probe; the rejection was unhandled and the host exited. The member now reads as absent (the host still supplies no override provenance; other unsupported members still refuse).

• A quit stops waiting for a slow Pi session_start handler so shutdown handlers run at once; reload, new, resume and fork still wait their turn.

• A Pi defaultThinkingLevel the model does not offer is now clamped to the nearest supported level (up first, then down, as Pi does) with no startup or /reload notice; applied Pi defaults no longer print a red reload failed: line, and a thinking level chosen in the session is kept across /reload.

• Pi mirror loading rechecks reviewed sources at each ordered factory import and after a failed native-ESM probe before fallback. A changed source is refused; this review check is not an operating-system sandbox.

• Pi's ctx.isProjectTrusted() applies its plain-repository rule for already enabled factories, allowing repo tooling such as language servers to start when no trust-requiring project resources exist. The signal cannot silently re-promote an owner after resources disappear or native trust is revoked; replacement owners reevaluate it. Native workspace trust, project-resource loading and tool policy are unchanged.

• Pi hook callback waits now share one bounded deadline, including the late-handler reserve. Resource discovery budgets 4 s for callbacks against the host's 5 s deadline, and tool guards remain fail-closed. Queueing, transport and pending tracked host operations are outside the callback budget.

• Resource /reload ends the old extension session binding with interrupted / reload and starts the replacement with reload, rather than reporting shutdown/resume. Ordinary quit and session resume remain distinct.

• Interactive shutdown reapplies saved terminal attributes after the runtime stops, preserving macOS PENDIN through extension reload and cleanup.

• Pi automatic-mirror capture and the live runner share one persistent transform and compile-cache directory instead of warming a cache the runner did not use.

• Explicitly enabled Pi setup preparation displays Loading your Pi setup while the native input pump retains typing and resize handling. Cold catalog capture still precedes the fully initialized branded frame; no cold-start performance parity is claimed.

Changed#

• Bash has no default deadline. Explicit per-call timeouts and configured ceilings still apply; cancellation retains process-tree cleanup.
• Native TOML themes can opt into a Pi presentation profile and explicitly override transcript styles, tool-state fills, horizontal padding and activity shimmer. Existing adapter snapshots retain legacy presentation defaults.
• Pi startup reuses source fingerprints and module resolutions and can import eligible reviewed ESM factories natively. Ordered registration and jiti fallback remain; the resolution cache repopulates after the format change.

Known limitations#

• Continue without a provider can load normally enabled, admitted extensions. Prompts and model-dependent operations stay unavailable until a model is configured and octet restarts.
• In codemode scripts, tools.bash resolves to octet's result (stdout, stderr, exit_code, …) and rejects on a non-zero exit. Pi resolves to {output, truncated, exit_code, wall_time_seconds}.
• Pi packages that start their own child agent session, such as /btw, don't work yet.
• pi-subagents, @narumitw/pi-goal and Pi codemode are replaced by octet's subagents, /goal and codemode and are not loaded; see docs/pi-compatibility.md#pi-packages-octet-replaces.
• Pi's startup [Skills] and [Prompts] listing isn't printed.
• With a Pi custom editor active, Enter in ! bash mode may not submit.

Added#

• Pi settings.json "defaultTools": ["+codemode"] turns on an installed, host-admitted octet-codemode bundle for that session only, with codemode.mode presentation defaults. Explicit CLI flags win; project settings count only in a trusted workspace; nothing is installed, granted or persisted.